<?xml version="1.0" encoding="UTF-8"?>
<tns:loginConfiguration xmlns:tns="http://www.worklight.com/auth/config" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

		<!-- Licensed Materials - Property of IBM
			 5725-G92 (C) Copyright IBM Corp. 2006, 2013. All Rights Reserved.
			 US Government Users Restricted Rights - Use, duplication or
             disclosure restricted by GSA ADP Schedule Contract with IBM Corp. -->	

	<!-- Uncomment the next element to protect the worklight console and the first section in securityTests below. -->
	 <staticResources>
	<!-- <resource id="worklightConsole" securityTest="WorklightConsole">
			<urlPatterns>/console*</urlPatterns>
		 </resource> 
		-->
		<resource id="subscribeServlet" securityTest="SubscribeServlet">
			<urlPatterns>/subscribeSMS*</urlPatterns>
		</resource>
	</staticResources> 

   <!--  Sample security tests  
         Even if not used there will be some default webSecurityTest and mobileSecurityTest 
		 Attention: if using <testAppAuthenticity/> test below ,<publicSigningKey> element must be added to application-descriptor.xml as well. -->   
         
	 <securityTests>
       	<!-- 
       	<customSecurityTest name="WorklightConsole">
       		<test realm="WorklightConsole" isInternalUserID="true"/>
       	</customSecurityTest>
		
		<mobileSecurityTest name="mobileTests">
			<testAppAuthenticity/> 
			<testDeviceId provisioningType="none" />
			<testUser realm="myMobileLoginForm" />
		</mobileSecurityTest>

		<webSecurityTest name="webTests">
			<testUser realm="myWebLoginForm"/>
		</webSecurityTest>

		<customSecurityTest name="customTests">
        	<test realm="wl_antiXSRFRealm" step="1"/>
        	<test realm="wl_authenticityRealm" step="1"/>
        	<test realm="wl_remoteDisableRealm" step="1"/>
            <test realm="wl_anonymousUserRealm" isInternalUserID="true" step="1"/>
			<test realm="wl_deviceNoProvisioningRealm" isInternalDeviceID="true" step="2"/>
       	</customSecurityTest>
       	-->
       	<customSecurityTest name="SubscribeServlet">
       		<test realm="SubscribeServlet" isInternalUserID="true"/>
       	</customSecurityTest>      	

	</securityTests> 
	
	<realms>
		<realm name="SampleAppRealm" loginModule="StrongDummy">
			<className>com.worklight.core.auth.ext.FormBasedAuthenticator</className>
		</realm>
		
		<realm name="WorklightConsole" loginModule="requireLogin">
			<className>com.worklight.core.auth.ext.FormBasedAuthenticator</className>
			<onLoginUrl>/console</onLoginUrl>
		</realm>
		
		<realm name="SubscribeServlet" loginModule="rejectAll">
			<className>com.worklight.core.auth.ext.HeaderAuthenticator</className>			
		</realm>
		<!-- For websphere -->
		<!-- realm name="WASLTPARealm" loginModule="WASLTPAModule">
      		<className>com.worklight.core.auth.ext.WebSphereFormBasedAuthenticator</className>
      		<parameter name="login-page" value="/login.html"/>
      		<parameter name="error-page" value="/loginError.html"/>
    	</realm -->
	</realms>

	<loginModules>
		<loginModule name="StrongDummy">
			<className>com.worklight.core.auth.ext.NonValidatingLoginModule</className>
		</loginModule>
		
		<loginModule name="requireLogin">
			<className>com.worklight.core.auth.ext.SingleIdentityLoginModule</className>
		</loginModule>
		
		<loginModule name="rejectAll">
			<className>com.worklight.core.auth.ext.RejectingLoginModule</className>
		</loginModule>
		
		<!-- For websphere -->
		<!-- loginModule name="WASLTPAModule">
      		<className>com.worklight.core.auth.ext.WebSphereLoginModule</className>
    	</loginModule -->
    	
    	<!-- For enabling SSO with no-provisioning device authentication -->
    	<!-- <loginModule name="MySSO" ssoDeviceLoginModule="WLDeviceNoProvisioningLoginModule">
			<className>com.worklight.core.auth.ext.NonValidatingLoginModule</className>
		</loginModule> -->
    	<!-- For enabling SSO with auto-provisioning device authentication -->
    	<!-- <loginModule name="MySSO" ssoDeviceLoginModule="WLDeviceAutoProvisioningLoginModule">
			<className>com.worklight.core.auth.ext.NonValidatingLoginModule</className>
		</loginModule> -->
	</loginModules>

</tns:loginConfiguration>
